CVE-2026-39831

Description

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

CVSS Metrics

• v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.42%• Percentile: 36%

Techniques & Countermeasures

• CWE-862•Missing Authorization

  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected Systems

• chainguard•aactl

  < 0.4.12-r53

• chainguard•act

  < 0.2.88-r6

• chainguard•actions-runner-controller

  < 0

• chainguard•actions-runner-controller-fips

  < 0

• chainguard•age

  < 0

• chainguard•age-fips

  < 1.3.1-r11 | < 0

• chainguard•agentbeat

  < 0

• chainguard•agentbeat-fips

  < 0

• chainguard•amass

  < 0

• chainguard•amazon-cloudwatch-agent

  < 0

• chainguard•amazon-cloudwatch-agent-fips

  < 0

• chainguard•amazon-cloudwatch-agent-operator

  < 0

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 0

• chainguard•amazon-ssm-agent

  < 3.3.4515.0-r2

• chainguard•amazon-ssm-agent-ecs-exec

  < 3.3.4515.0-r2

• chainguard•amazon-ssm-agent-ecs-exec-fips

  < 3.3.4515.0-r3

• chainguard•amazon-ssm-agent-fips

  < 3.3.4515.0-r3

• chainguard•apache-exporter

  < 0

• chainguard•apko

  < 1.2.14-r2

• chainguard•apko-fips

  < 1.2.14-r2

• chainguard•apm-server-8.19

  < 0

• chainguard•apm-server-9.1

  all

• chainguard•apm-server-9.3

  < 0

• chainguard•apm-server-9.4

  < 0

• chainguard•apply-cve-bump

  < 0.2.280-r0

• chainguard•argo-cd-3.0

  all

• chainguard•argo-cd-3.0-compat

  all

• chainguard•argo-cd-3.1

  < 3.1.16-r3

• chainguard•argo-cd-3.1-compat

  < 3.1.16-r3

• chainguard•argo-cd-3.3-compat

  all

• chainguard•argo-cd-3.4

  < 3.4.2-r4

• chainguard•argo-cd-3.4-compat

  < 3.4.2-r4

• chainguard•argo-cd-fips-3.0

  all

• chainguard•argo-cd-fips-3.0-compat

  all

• chainguard•argo-cd-fips-3.1

  < 3.1.16-r1

• chainguard•argo-cd-fips-3.1-compat

  < 3.1.16-r1

• chainguard•argo-cd-fips-3.2

  < 3.2.12-r5

• chainguard•argo-cd-fips-3.2-compat

  < 3.2.12-r5

• chainguard•argo-cd-fips-3.4

  < 3.4.2-r4

• chainguard•argo-cd-fips-3.4-compat

  < 3.4.2-r4

• chainguard•argo-events

  < 1.9.10-r24

• chainguard•argo-events-fips

  < 1.9.10-r17

• chainguard•argo-rollouts

  < 0

• chainguard•argo-workflow-controller-3.6

  < 3.6.19-r7

• chainguard•argo-workflow-controller-fips-3.6

  < 3.6.19-r9

• chainguard•argo-workflow-executor-3.6

  < 3.6.19-r7

• chainguard•argo-workflow-executor-fips-3.6

  < 3.6.19-r9

• chainguard•argo-workflows-3.6

  < 3.6.19-r7

• chainguard•argo-workflows-fips-3.6

  < 3.6.19-r9

• chainguard•argocd-image-updater

  < 1.2.1-r2

Showing first 50 affected entries in server-rendered view.

References (14)

• https://go.dev/issue/79566
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781662
• https://pkg.go.dev/vuln/GO-2026-5019
• https://nvd.nist.gov/vuln/detail/CVE-2026-39831
• https://cs.opensource.google/go/x/crypto
• https://security-tracker.debian.org/tracker/CVE-2026-39831
• https://ubuntu.com/security/CVE-2026-39831
• https://www.cve.org/CVERecord?id=CVE-2026-39831
• https://github.com/golang/crypto/commit/b61cf853a89d82cad68da5e12a6beca2116f8456
• https://ubuntu.com/security/notices/USN-8447-1
• https://ubuntu.com/security/notices/USN-8447-3
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39831.json